tag: Cryptomining · 6 items
- Engineer — Act: Active exploitation began within a day of PoC publication; patch Plex Media Server to the latest available release immediately, or block external access to the Plex port until patching is possible.
- SOC/IR — Act: Exploitation is live with known payload types — hunt for anomalous CPU-intensive child processes spawned by the Plex service and unusual outbound proxy/tunnel connections on hosts running Plex since the PoC release date.
- Leader — Skip
- Engineer — Learn: Panchan is a Go-based P2P botnet that spreads via SSH brute-force and drops cryptominers on Linux hosts — relevant to any team running internet-exposed Linux infrastructure, but the summary is too thin to identify new IOCs or required config changes.
- SOC/IR — Learn: An intern analysis of Panchan may surface behavioral indicators useful for tuning SSH brute-force and cryptominer detections, but no IOCs or ATT&CK mappings are provided in this summary to act on immediately.
- Leader — Skip
- Engineer — Act: Active exploitation of AhsayCBS is confirmed with web shell and XMRig miner deployment, and a public PoC is available on GitHub. Patch AhsayCBS immediately and audit any instances for web shell artifacts and unauthorized processes on affected hosts.
- SOC/IR — Act: Attackers are actively deploying web shells and XMRig miners disguised as Microsoft Edge on compromised AhsayCBS hosts — hunt for msedge.exe processes running from unexpected directories and sweep backup server hosts for web shell indicators since the public PoC dropped.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: If your org runs any externally exposed AI inference or LLM serving endpoints, audit them now for public reachability and missing authentication; review running processes on those hosts for unauthorized miners or scanning activity.
- SOC/IR — Learn: Active campaign to track, but the summary provides no IOCs, ATT&CK mappings, or detection signatures — insufficient detail to write or tune detections today; revisit if a full technical write-up with indicators surfaces.
- Leader — Skip
- Engineer — Plan: Microsoft Threat Intelligence documents active exploitation of exposed LiteLLM gateways leading to credential theft and persistence — no KEV or PoC signal, but if you run LiteLLM or similar AI proxies, audit internet exposure, rotate API keys, and verify no unauthorized processes are running on those hosts.
- SOC/IR — Act: Active attack chain with detectable post-exploitation stages (credential harvesting, persistence, cryptomining) reported by Microsoft TI — pull the blog post for IOCs, then hunt for anomalous processes and outbound connections on any hosts running AI gateway software since the publication date.
- Leader — Plan: AI workloads are now an established attack surface for credential theft and resource abuse; this quarter, ensure AI infrastructure (gateways, API proxies, GPU hosts) is included in your hardening and access-review scope alongside traditional edge assets.
- Engineer — Act: Active exploitation with public PoC — audit your macOS fleet for Screen Sharing (VNC) exposure and apply Apple’s patch immediately; disable Screen Sharing on hosts where it isn’t required.
- SOC/IR — Act: Hunt for unexpected xmrig or Monero miner processes on macOS endpoints and check for anomalous outbound connections to mining pools since the PoC went public.
- Leader — Learn: Active cryptomining campaign on macOS is unlikely to require board-level action, but confirms macOS is not a safe-harbor — useful context for endpoint policy discussions.